apiVersion: batch/v1beta1 # Use 'batch/v1' for K8s v1.21+.
kind: CronJob
metadata:
  name: aksupport-cronjob
spec:
  jobTemplate:
    spec:
      completions: 1
      backoffLimit: 0
      activeDeadlineSeconds: 120
      template:
        spec:
          securityContext:
            runAsNonRoot: true
            runAsUser: 10101
            seccompProfile: # Requires K8s 1.19+, use annotation equivalent for older versions.
              type: RuntimeDefault
          containers:
          - name: aksupport
            image: public.ecr.aws/stevenjdh/aksupport
            # Uncomment below for testing a specific version.
            #args:
            #- "1.17.0"
            imagePullPolicy: Always
            env:
            - name: AZMON_COLLECT_ENV # Required to prevent sensitive data leaking to Azure Monitor Logs.
              value: "FALSE"
            envFrom:
            - configMapRef:
                name: aksupport-config
            - secretRef:
                name: aksupport-secret
            resources:
              requests:
                memory: "256Mi"
                cpu: "500m"
              limits:
                memory: "512Mi"
                cpu: "1000m"
            volumeMounts:
            - mountPath: /tmp
              name: tmp
            securityContext:
              readOnlyRootFilesystem: true # Causes 'Failed to create CoreCLR, HRESULT: 0x80004005', so fix using tmp volume mount.
              allowPrivilegeEscalation: false
              capabilities:
                drop:
                - ALL
          volumes:
          - emptyDir: {}
            name: tmp
          restartPolicy: Never       
  schedule: '0 8 * * *'
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1